Jenkins September 2023 Newsletter

Damien DUPORTAL

Mark Waite

Bruno Verachten

Wadeck Follonier

Kevin Martens

Alyssa Tong October 12, 2023

Jenkins September Newsletter

Key Takeaways

JDK21 is around the corner

Security Update

Contributed by: Wadeck Follonier

A plugin security advisory was published on September 6.
- Security Advisory 2023-09-06
- This included multiple high score vulnerabilities in various plugins.
A core security advisory was published on September 20.
- Security Advisory 2023-09-20
- Multiple vulnerabilities were corrected in core.
- This advisory also included fixes for a plugin.

Governance Update

Contributed by: Mark Waite

Voter registration is now open for the 2023 Jenkins elections. We’re electing two board members and all five officers. Jenkins contributors must register to vote in each year’s elections.

How do I register to vote?

More detailed instructions are available in the Jenkins elections 2023 blog post.

New Jenkins features

The 10 year old JavaScript library, Prototype.js, has been removed from Jenkins 2.426 as announced in a recent blog post by Basil Crow. The Jenkins board extends its sincere thanks to Tim Jacomb, Basil Crow, Rahul Somasunderam, and many others that worked to remove that old library from Jenkins core and over 60 plugins.

Infrastructure Update

Contributed by: Damien Duportal

The bandwidth reduction on Artifactory is complete as repo.jenkins-cio.org no longer mirrors Apache Maven repositories, thanks to our infrastructure caching. We’ve seen a decrease of more than 50% in monthly outbound downloads.
We’ve been doing some plumbing work to increase the availability of jenkins.io web services during operations (or those pesky unplanned infrastructure problems). No more outages when upgrading Kubernetes for replicated services. That’s right, we’ve got your back!
We have a new sponsor for the Jenkins Project in Cloudflare. We’re currently evaluating migrating updates.jenkins.io to their system next month. Exciting times ahead!
ARM64: We’ve migrated 5 new services, making for a total of 7, from x86 to ARM64, including jenkins.io and javadoc.jenkins.io. We’re moving on up!
It’s time to say goodbye to Oracle Cloud! The sponsorship has ended and archives.jenkins.io now runs on DigitalOcean. We’re grateful to both of these providers for their past and present help. Here’s to new beginnings!

Platform Modernization Update

Contributed by: Bruno Verachten

JDK21
- Infrastructure
  - We’re working with updatecli to keep the JDK21 updated.
  - We’re still waiting for the official release.
- Docker images:
  - Ssh agent: first JDK 21 preview images
  - Docker agent: first JDK 21 preview images
  - Inbound agent: first JDK21 preview images
  - Controller: first JDK21 preview images
Java 11, 17, and 21 with Jenkins
- Refer to Mark Waite’s Google Doc for further information.
  - A draft was sent to the Jenkins board and officers.
- Since a pciture is worth a thousand words, here is a diagram.
- It needs further discussion and refinement before it is finalized.
Work on agent and controller images
- Docker-agent received a few version bumps and two breaking changes, resulting in seven releases.
  - 💥 Breaking change: Moving to bookworm.
  - 💥 Breaking change: Using a ltsc2019 base image for windowsservercore-ltsc2019 agent images.
- Inbound-agent received a few version bumps and two breaking changes, resulting in four new releases.
  - 💥Breaking change: Moving to bookworm.
  - 💥Breaking change: Using a ltsc2019 base image for windowsservercore-ltsc2019 agent images and add a nanoserver-ltsc2019 image.

Documentation Update

Contributed by: Kevin Martens

During September, there were several updates for the community blog and Jenkins documentation.

First, there were 10 blog posts written by 11 different authors. The blog posts include updates and recaps for the Google Summer of Code, the 2023 Jenkins board and officer elections, and a review of the Artifactory bandwidth reduction project.

The Jenkins security section now includes a list of all security issues since 2018. This list compiles all security issues that have been published in a security advisory.

Finally, a new Platform Information section was added to the Jenkins user handbook. This section contains support polciies for the Jenkins platform and upgrade guides for Java versions in Jenkins.

Outreach and advocacy Update

Contributed by: Alyssa Tong

Hacktoberfest is in progress!

There’s still time to register, pick your projects, and contribute. Registration is between September 26 and October 31 on the Hacktoberfest site. Read how you could contribute to Jenkins.

Jenkins in Google Summer of Code 2023 has concluded!

Congratulations to all 4 GSoC contributors for their completion of this year’s program. Read more about their projects in their blog posts below:

About the authors

Damien DUPORTAL

Damien is the Jenkins Infrastructure officer and a software engineer at CloudBees working as a Site Reliability Engineer for the Jenkins Infrastructure project. Not only he is a decade-old Hudson/Jenkins user but also an open-source citizen who participates in Updatecli, Asciidoctor, Traefik and many others.

Mark Waite

Mark is a member of the Jenkins governing board, a long-time Jenkins user and contributor, a core maintainer, and maintainer of the git plugin, the git client plugin, the platform labeler plugin, the embeddable build status plugin, and several others. He is one of the authors of the "Improve a plugin" tutorial.

Bruno Verachten

Bruno is a father of two, husband of one, geek in denial, beekeeper, permie and a Developer Relations for the Jenkins project. He’s been tinkering with continuous integration and continuous deployment since 2013, with various products/tools/platforms (Gitlab CI, Circle CI, Travis CI, Shippable, Github Actions, …), mostly for mobile and embedded development.
He’s passionate about embedded platforms, the ARM&RISC-V ecosystems, and Edge Computing. His main goal is to add FOSS projects and platforms to the ARM&RISC-V architectures, so that they become as boring as X86_64.
He is also the creator of miniJen, the smallest multi-cpu architectures Jenkins instance known to mankind.

Wadeck Follonier

Wadeck is the Jenkins security officer, leading the security team in improving Jenkins security. He likes to provide solutions that are both useful and easy to use.

Kevin Martens

Kevin Martens is part of the CloudBees Documentation team, helping with Jenkins documentation creation and maintenance.

Alyssa Tong

Member of the Jenkins Advocacy and Outreach SIG. Alyssa drives and manages Jenkins participation in community events and conferences like FOSDEM, SCaLE, cdCON, and KubeCon. She is also responsible for Marketing & Community Programs at CloudBees, Inc.